Lora Bentley spoke with Lawrence Rosen, founding partner of Rosenlaw & Einschlag, a technology law firm in California. Rosen currently advises the Apache Foundation and the Python Foundation, and previously served as general counsel for the Open Source Initiative.
Bentley: You have said that one of the best things about the latest draft of GPL v3 is that it allows its software to be used in aggregations, which, as I understand it, do not trigger the requirement that the other software must also be released under GPL v3? Can you explain how that works?
Rosen: I'll try to do so. It really has to do with something that's in the copyright law as well as something that's in the GPL. When you put two works together, you can put them together in a number of different ways. For example, you can build a collection of the greatest poems of the 20th Century and put them together in a book. Each one of those poems is written by its own author, has its own copyright, has its own license terms. The publisher may or may not allow you to put that poem in a collection of the greatest poems of the 20th Century. That's an aggregation, and assuming that the authors of the works or the owners of the works authorize you to put copies of the works into a collection such as "Greatest Poems of the 20th Century," then you're allowed to do that.
One of the things about the GPL is it contains an explicit provision that says you can make verbatim copies of GPL works and include them in aggregations. What that means is essentially the same thing that the copyright law means by this permission to create what is called "collective works," or works like collections of poems. So, for example, you can have collections of modules, collections of drivers, collections of software that can be under various licenses. So long as those licenses, like GPL v3, allow you to take verbatim copies and include them in aggregations, that's fine.
Bentley: And the new GPL now allows Apache licensed software to be used in GPL projects, correct?
Rosen: Correct, but that's a different kind of combination, and we need to be very careful to distinguish what I just described to you in terms of collective works or aggregations, from the kind of combinations that are allowed with Apache works. The thing that GPL v3 allows is that you can take an Apache work, and modify it as the Apache License allows, in order to fit it into and have it become a part of a GPL v3 work. For example, you can create a GPLv3-licensed version of a Web server or any other Apache software. You can release that software under the GPL license because the Apache License and the GPL v3 are compatible. I didn't say that you could do that kind of thing with other works in aggregations. An aggregation is a little bit different. The Apache compatibility is this ability to take Apache works and embed them into and modify them for, evolve them into, GPL v3 works.
Bentley: But the same isn't true - you can't take a GPLv3 work and embed it into Apache-licensed works, correct?
Rosen: No, you can't.... Well, again, it depends whether what you're talking about is an aggregation or a more complicated - what I call a derivative work. If all you're creating is an aggregation of modules, you can combine Apache modules and GPL modules and any other modules, as long as [the licenses] allow you to do that. And with respect to Apache works being merged into a GPL work, that's allowed. But a GPL work being merged into an Apache work? No. That can't be done.
Bentley: Why the difference?
Rosen: The difference is that the GPL license says - both v2 and v3 - that if you create a derivative work, that derivative work must be licensed under the GPL. So if I take an Apache work and mush it together with a GPL work, the resulting work has to be GPL.
Bentley: Similarly, you've said that your least favorite terms in the new GPL are the ones that deal with patent protection. The Free Software Foundation, from what we've read, has been pretty clear that was included in the new GPL specifically to prevent agreements like the one between Microsoft and Novell from happening again. Why do you think they took that particular approach, and what in your opinion, would be a better approach to dealing with those issues?
Rosen: Well, it's a very complicated question. I think certainly the authors of the GPL can specify any rules that they want with respect to their software. If they don't like their software to be combined with software that other people produce or with patents that other people have, they're certainly free to do so.
My concern is that the software world is being inhibited by software patents. Rather than trying to prevent software from being used if it has patents in it, we ought to find ways of living with the patent problem that exists - including companies like Microsoft that have patents and other companies that have patents. I'm not sure that the way the GPL v3 tries to deal with patents is actually going to solve the problem.
Bentley: Moving to another seemingly controversial aspect of GPL v3, it so far has left what's been called the "ASP loophole" open. There are several people within the open source community who are upset by that. Can you explain what that loophole does and why so many see it as a problem?
Rosen: It's a loophole that concerns me and has concerned many people for quite some time. The way the GPL currently works, if you take GPL software and modify it, you don't have to tell anyone about it. You can do that in complete freedom, privately, secretly, without disclosing any of your source code - unless you distribute that code. The problem is that there are - at least I call it a problem - there are a lot of companies that take open source software, bring it in house, and they use it. They modify it, and they don't disclose their changes because they don't distribute it, even though what they're doing is using the software to provide services to third parties. For example, Google does that, and probably many other companies are modifying open source software and using it to provide services over networks to other people, other companies.
The [proposed] ASP provision plugs that loophole by saying if you provide services of some sort to third parties, that's a distribution and you have to disclose your source code. The GPL chose not to do that, and that, I think, is unfortunate because it's a big loophole. It allows a lot of companies to take open source software, bring it in house, use it, make money off of it, change it, and then not bother giving any of those changes back to the people who wrote the software in the first place.
Bentley: Finally, you have indicated - and understandably so - that you still prefer your own Open Software License to the GPL. Are there certain instances in which that's the case, or would you just generally prefer your own license? Why?
Rosen: ... [T]he ASP [provision] is in the Open Software License. Patent provisions that deal fairly with patents and expect people to give patent licenses when they license their software, but not to give every patent they ever owned, that's in the Open Software License. There are a lot of provisions in the Open Software License that I think make it much clearer than do the provisions in the GPL, that you can use OSL works for aggregations or collective works. The provisions that the OSL has are basically the same as the provisions that the GPL has, only much clearer, much shorter, and solve things like the ASP [loophole] and patent provisions in more reasonable ways.